Sell Warya products through your own system

Authentication

Every request carries your key in the X-API-Key request header. The key is a secret: send it in the header only, never in a URL, a query string or a log line — a key in a URL ends up in browser history, proxy logs and screenshots. The API trusts no forwarded header, so a key's optional IP allow-list cannot be spoofed.

curl "https://api.waryashop.org/api/v1/games" \
  -H "X-API-Key: YOUR_API_KEY"

Endpoints

Every path is relative to the base URL above. Each operation needs the scope named beside it.

Catalog

Checkout

Account

Scopes

A key reaches only the endpoints its scopes cover. A request whose key lacks the scope an endpoint needs answers 403 and names the missing scope. The read-only set is granted by default; creating an order is a scope you must ask for.

Rate limits

These are the limits the API actually enforces, in requests per minute.

Every answer carries X-RateLimit-Limit and X-RateLimit-Remaining. A refusal is a 429 and also carries Retry-After and X-RateLimit-Reset — read those before retrying; the same wait is repeated in the body as meta.retry_after.

Pagination

Listing endpoints are paged with page and per_page (alias limit). per_page is clamped to 1..100 on the order and transaction listings; the catalogue listings default to, and are capped at, 500 families per page, and meta.has_more tells you when there are more.

Every listing answer carries meta with current_page, last_page, per_page, total, count and request_id, so a client can walk pages and still quote one correlation id.

curl "https://api.waryashop.org/api/v1/orders?page=2&per_page=50" \
  -H "X-API-Key: YOUR_API_KEY"

Errors

Every answer — success or failure — is one JSON envelope with success, error_code, message and meta.request_id. Failures repeat the code and message under error. Quote meta.request_id in any support request.

{
    "success": false,
    "error": {
        "code": "MISSING_API_KEY",
        "message": "X-API-Key header is required."
    },
    "error_code": "MISSING_API_KEY",
    "message": "X-API-Key header is required.",
    "meta": {
        "request_id": "01J8ZQ4M6W9K2N7P3R5T8V0XYZ"
    }
}

{
    "success": false,
    "error": {
        "code": "SCOPE_FORBIDDEN",
        "message": "This API key does not grant the \"catalog:read\" scope."
    },
    "error_code": "SCOPE_FORBIDDEN",
    "message": "This API key does not grant the \"catalog:read\" scope.",
    "meta": {
        "request_id": "01J8ZQ4M6W9K2N7P3R5T8V0XYZ"
    }
}

Every status

Do not retry 401, 402, 403 or 422 without correcting the request. Back off exponentially for a 429 and for temporary 5xx answers.

Idempotency on order creation

Creating an order spends money, so POST /orders is idempotent through the Idempotency-Key request header — the only published mechanism. Send the same key with the same body to retry safely: a replay returns the first order, with idempotent_replay set to true, and charges nothing again. The same key with a different body is a 409 for your account; a key another account happens to use is that account's own and never collides with yours.

curl -X POST "https://api.waryashop.org/api/v1/orders" \
  -H "X-API-Key: YOUR_API_KEY" \
  -H "Idempotency-Key: 8f3kd-order-1042" \
  -H "Content-Type: application/json" \
  -d '{"game":"pubgm","catalogue_name":"60 UC","player_id":"12345678"}'

Customer webhooks

Send a callback_url when you create an order and Warya pushes each order event to it. Every delivery is signed, so you can trust it came from us and was not altered in transit. Retries follow the schedule below; a rotated secret keeps signing alongside its successor for a grace window so you can roll the verification over without dropping events.

:raw_body = the exact bytes you received
t, v1 = the two values in X-Warya-Signature
expected = hmac_sha256(key = WEBHOOK_SECRET, message = t + "." + event_id + "." + raw_body)
ok = hash_equals(expected, v1)  # compare in constant time

Get started

1. 1. Create an account

   Register on Warya and sign in. Every reseller account includes API keys, IP allow-lists and signed webhooks.

   Create an account →

2. 2. Request reseller (API) access

   The self-service reseller-access request flow is not live yet. Until it is, ask for API access through our support channel on Telegram and we will enable it for your account.

   Contact support on Telegram →

3. 3. Create a key

   Once you are signed in, open the API keys page and create your key. Pick the scopes you need; the read-only set is a good start.

4. 4. Call /api/v1/games

   Read the catalogue with your key. A request with no key answers the 401 body below — the real response captured from the live API:

   curl "https://api.waryashop.org/api/v1/games" \
     -H "X-API-Key: YOUR_API_KEY"

   With no key, the live API answers:

   {
       "success": false,
       "error": {
           "code": "MISSING_API_KEY",
           "message": "X-API-Key header is required."
       },
       "error_code": "MISSING_API_KEY",
       "message": "X-API-Key header is required.",
       "meta": {
           "request_id": "01J8ZQ4M6W9K2N7P3R5T8V0XYZ"
       }
   }

5. 5. Place an order

   Confirm a player, then post the order with an Idempotency-Key (the request shown in section 08). Here is the 201 it answers with:

   {
       "success": true,
       "order_id": "WR-20261010-8F3KD",
       "status": "processing",
       "charged": "0.950000",
       "currency": "USD",
       "idempotent_replay": false,
       "data": {
           "order_id": "WR-20261010-8F3KD",
           "status": "processing",
           "charged": "0.950000",
           "currency": "USD",
           "idempotent_replay": false
       },
       "meta": {
           "request_id": "01J8ZQ4M6W9K2N7P3R5T8V0XYZ"
       }
   }

6. 6. Receive the webhook

   Send a callback_url when you create the order; we push each order event to it, signed with the scheme above. If you would rather poll, read GET /orders/{orderId} and stop when the status is completed, failed or refunded.